{"id":"CVE-2026-124739","kind":"vulnerability","aliases":["CVE-2026-124739"],"related":[],"title":"BusyBox httpd: long index page name overflows stack, enabling code execution","description":"A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process.","summary":"BusyBox httpd copies the index page name from an 'I:' rule in a subdirectory httpd.conf into a stack buffer with strcpy(). A name that is too long overflows it when that directory is requested. Red Hat says this can crash httpd or possibly run code in the forked child, which runs as root unless httpd is started with -u. No upstream fix or affected version range is published yet.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"busybox","fixed":[],"affected":"unknown (not published)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["busybox","embedded","httpd","infrastructure","linux","root-privileges"],"not_affected_if":["httpd-not-used","httpd-run-with-u-option","web-root-admin-only"],"how_to_check":"- Run 'busybox httpd --help' (or check for a running 'busybox httpd' / 'httpd' process) to see whether BusyBox httpd is in use.\n- Look for httpd.conf files in subdirectories of the web root that contain an 'I:' line, and check who can write them.\n- Check whether httpd was started with -u <user>; without it the child runs as root.\n- Affected and fixed versions: unknown. Red Hat lists none and no upstream commit is linked yet. Watch the Red Hat page and busybox.net.","fix":null,"status":"open","published_at":"2026-11-11T11:17:16+00:00","first_seen_at":"2026-11-11T11:26:56+00:00","triaged_at":"2026-11-11T11:27:32+00:00","updated_at":"2026-11-11T11:28:18+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-11T11:27:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"BusyBox httpd: long index page name overflows stack, enabling code execution","impact":"high","summary":"BusyBox's httpd web server has a stack-based buffer overflow when it processes subdirectory configuration files with an overly long index page name. An attacker who can write such a configuration file could run code with elevated privileges or crash the server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["busybox","httpd","embedded","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code with elevated privileges on the server","analyst_note":"Find the affected and fixed BusyBox versions and the upstream commit from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124739 to fill in fix and how_to_check.","how_to_check":"- Run `busybox --help` or `busybox httpd --help` to confirm BusyBox httpd is present on the machine\n- Check whether httpd is serving from a directory where untrusted users can write `.httpd.conf`-style subdirectory configuration files\n- Compare the BusyBox version against the fixed version: unknown","plain_action":"","product_name":"busybox","needs_analyst":true,"not_affected_if":["httpd-not-used","web-root-admin-only"],"who_is_affected":"Only systems running BusyBox httpd (the small web server built into BusyBox) are exposed. The exposure requires an attacker who can write to a subdirectory configuration file served by httpd, so systems where only trusted administrators control the web root are less at risk. The sources do not name affected BusyBox versions.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000772,"input_tokens":4550,"output_tokens":635,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed BusyBox versions and the upstream commit from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124739 to fill in fix and how_to_check.","search":"'-124739':14A,17A '-2026':13A,16A 'affect':90B 'arbitrari':142C 'attack':126C 'base':122C 'buffer':45B,123C 'busybox':1A,18A,19B,27B,101C 'caus':148C 'child':75B 'code':10A,71B,143C 'configur':109C,134C 'copi':29B 'could':136C 'crash':66B,155C 'cve':12A,15A 'denial':150C 'directori':58B 'dos':153C 'elev':145C 'embed':20B 'enabl':9A 'execut':11A,141C 'exploit':137C 'file':110C,135C 'fix':88B 'flaw':97C 'fork':74B 'found':99C 'hat':62B 'httpd':2A,21B,28B,67B,81B,104C 'httpd.conf':41B 'index':4A,31B,114C 'infrastructur':22B 'linux':23B 'long':3A,53B,113C 'name':6A,33B,49B,116C 'over':112C 'overflow':7A,54B,124C 'page':5A,32B,115C 'permiss':128C 'possibl':69B 'privileg':26B,146C 'process':107C,158C 'publish':94B 'rang':92B 'red':61B 'request':60B 'root':25B,79B 'root-privileg':24B 'rule':37B 'run':70B,77B 'say':63B 'server':106C,157C 'servic':152C 'stack':8A,44B,121C 'stack-bas':120C 'start':83B 'strcpi':47B 'subdirectori':40B,108C,133C 'trigger':118C 'u':85B 'unless':80B 'upstream':87B 'version':91B 'vulner':139C 'web':105C 'write':130C 'yet':95B","nicknames":[],"mitigations":[],"who_affected":"Only systems that run BusyBox httpd (the small web server built into BusyBox, common on routers, embedded devices and containers) are exposed. The attacker must be able to write an httpd.conf file in a directory served by httpd (Red Hat rates it Important for local users with write access to the web root). Systems where httpd is not used, or where only administrators can write to the web root, can skip it. Affected versions are not yet published.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["busybox"],"ptokens":["busybox"],"labels":["busybox","embedded","high","httpd","infrastructure","linux","rootprivileges","vendor"],"campaign_type":null,"search_a":"'-124739':14A,17A '-2026':13A,16A 'busybox':1A,18A 'code':10A 'cve':12A,15A 'enabl':9A 'execut':11A 'httpd':2A 'index':4A 'long':3A 'name':6A 'overflow':7A 'page':5A 'stack':8A","search_b":"'affect':90B 'buffer':45B 'busybox':19B,27B 'child':75B 'code':71B 'copi':29B 'crash':66B 'directori':58B 'embed':20B 'fix':88B 'fork':74B 'hat':62B 'httpd':21B,28B,67B,81B 'httpd.conf':41B 'index':31B 'infrastructur':22B 'linux':23B 'long':53B 'name':33B,49B 'overflow':54B 'page':32B 'possibl':69B 'privileg':26B 'publish':94B 'rang':92B 'red':61B 'request':60B 'root':25B,79B 'root-privileg':24B 'rule':37B 'run':70B,77B 'say':63B 'stack':44B 'start':83B 'strcpi':47B 'subdirectori':40B 'u':85B 'unless':80B 'upstream':87B 'version':91B 'yet':95B","search_c":"'arbitrari':142C 'attack':126C 'base':122C 'buffer':123C 'busybox':101C 'caus':148C 'code':143C 'configur':109C,134C 'could':136C 'crash':155C 'denial':150C 'dos':153C 'elev':145C 'execut':141C 'exploit':137C 'file':110C,135C 'flaw':97C 'found':99C 'httpd':104C 'index':114C 'long':113C 'name':116C 'over':112C 'overflow':124C 'page':115C 'permiss':128C 'privileg':146C 'process':107C,158C 'server':106C,157C 'servic':152C 'stack':121C 'stack-bas':120C 'subdirectori':108C,133C 'trigger':118C 'vulner':139C 'web':105C 'write':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T11:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124739","severity":null,"published_at":"2026-11-11T11:17:16+00:00","modified_at":"2026-11-11T11:17:17+00:00","first_seen_at":"2026-11-11T11:26:56+00:00","fetched_at":"2026-11-11T11:26:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124739:3540","url":"https://access.redhat.com/security/cve/CVE-2026-124739","severity":null,"published_at":"2026-11-11T11:28:18+00:00","modified_at":"2026-11-11T11:28:18+00:00","first_seen_at":"2026-11-11T11:28:18+00:00","fetched_at":"2026-11-11T11:28:18+00:00","note":"Red Hat CVE page + Bugzilla 2571613 give the mechanism (I: rule in subdirectory httpd.conf, strcpy into stack buffer in handle_incoming_and_exit, child runs as root unless -u). No affected/fixed BusyBox versions or upstream commit published yet; NVD page is empty. Latest release 1.38.0 (May 2026); unconfirmed whether it is affected.","cites":["https://access.redhat.com/security/cve/CVE-2026-124739","https://bugzilla.redhat.com/show_bug.cgi?id=2571613"]}],"documents":[{"id":125069,"url":"https://access.redhat.com/security/cve/CVE-2026-124739","title":"Red Hat CVE-2026-124739","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":125071,"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571613","title":"Red Hat Bugzilla 2571613: httpd stack buffer overflow via I: rule","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}